Verizon patches email flaw that exposed user accounts
The vulnerability was discovered by researcher Randy Westergren, a software developer for XDA Developers. In a blog post this week, the security expert said the bug "would have allowed an attacker to intercept incoming emails from any user's inbox without interaction."
The researcher has worked with Verizon on multiple occasions to fix security flaws and has previously disclosed a critical vulnerability in Verizon's MyFiOS app's API.
This particularly severe security concern, however, lies within Verizon's webmail portal. The Insecure Direct Object References (IDOR) vulnerability was found within the "Settings" tab of the portal, which contained weaknesses in user identification systems.
The researcher altered the forwarding settings of his own account to a substitute account with another userID value. While this is an internal ID rather than the target's true email address, Verizon "exposes an API with which an attacker (or anyone) could look up this internal ID," according to the researcher.
The ID change request was successful, which meant that an attacker could substitute their own Verizon ID and set a forwarding address to receive the victim's emails. This is a serious problem not only for basic privacy but as many of us use a single email address to retain control over multiple online accounts, access to this address could be used to intercept password reset requests for anything from Facebook to online banking.
The vulnerability was reported to the US broadband provider on April 14 and the flaw was patched on May 12.
Комментарии